Executive brief
Dompdf is a PHP library used to convert HTML documents into PDF files. A security flaw in how the software restricts file access allows an attacker to bypass directory boundaries and view files they should not have access to. If an attacker can control the HTML content being converted, they could potentially read sensitive files located in sibling directories on the server, such as backup folders or administrative directories.
Technical details
A path traversal vulnerability exists in Dompdf's `validateLocalUri()` method due to improper validation of chroot boundaries. The library uses `realpath()` to normalize paths, which removes trailing directory separators. It then uses `strpos()` to verify if the requested file path starts with the allowed chroot path. Because the trailing slash is missing, a chroot defined as `/var/www` will incorrectly validate paths starting with `/var/www-admin` or `/var/www_backup`. An attacker who can provide HTML input to the converter can use this to include and read files from these sibling directories. The vulnerability is patched in version 3.1.6 by ensuring proper directory boundary enforcement.
Affected products
- dompdf dompdf <= 3.1.5
Timeline
- 2026-07-20: patched: Version 3.1.6 released
- 2026-07-20: advisory: GitHub Security Advisory GHSA-wvh6-f5jh-8gw4 published
- 2026-07-28: disclosed: CVE-2026-55554 published to NVD